CVE-2026-10679— Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)
Quick assessment
Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 zephyrproject Zephyr 4.4.0及之前版本存在数字错误漏洞，该漏洞源于DesignWare SPI驱动在计算SPI BAUDR时钟分频器时未验证config->frequency字段，可能导致用户空间线程通过传递频率值为0触发无符号整数除零错误，从而引起CPU异常、内核故障和本地拒绝服务。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| zephyrproject | zephyr | 1.8.0< 4.5.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10679
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)
Source: CVE Program / CVE List V5
Vulnerability Description
The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency.
spi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure().
On Cortex-M Mainline (SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service.
The fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
除零错误
Source: CVE Program / CVE List V5
Vulnerability Title
zephyrproject zephyr 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 zephyrproject Zephyr 4.4.0及之前版本存在数字错误漏洞，该漏洞源于DesignWare SPI驱动在计算SPI BAUDR时钟分频器时未验证config->frequency字段，可能导致用户空间线程通过传递频率值为0触发无符号整数除零错误，从而引起CPU异常、内核故障和本地拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zephyrproject | zephyr | 1.8.0 ~ 4.5.0 | - |
|
II. Public POCs for CVE-2026-10679
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10679
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-10679 (1)
Vendor Advisories for CVE-2026-10679 (1)
Same Patch Batch · zephyrproject · 2026-07-21 · 6 CVEs total
| CVE-2026-10678 | 8.1 HIGH | NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an una |
| CVE-2026-10680 | 7.6 HIGH | Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` |
| CVE-2026-10677 | 6.5 MEDIUM | Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the |
| CVE-2026-10674 | 5.5 MEDIUM | DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disab |
| CVE-2026-10675 | 4.3 MEDIUM | Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re |
IV. Related Vulnerabilities
Same product: zephyr
-
CVE-2026-17054
Out-of-bounds read and permanent loss of Wi-Fi reception in -
CVE-2026-15890
AEAD nonce reuse in Zephyr secure_storage ITS default nonce -
CVE-2026-17052
Missing user-pointer validation in tgpio_pin_read_ts_ec sysc -
CVE-2026-17051
Out-of-bounds write in the Intel SEDI IPM driver from an unv -
CVE-2026-17050
Double free of the USB host configuration descriptor when de
Same vendor: zephyrproject
-
CVE-2026-17054
Out-of-bounds read and permanent loss of Wi-Fi reception in -
CVE-2026-15890
AEAD nonce reuse in Zephyr secure_storage ITS default nonce -
CVE-2026-17052
Missing user-pointer validation in tgpio_pin_read_ts_ec sysc -
CVE-2026-17051
Out-of-bounds write in the Intel SEDI IPM driver from an unv -
CVE-2026-17050
Double free of the USB host configuration descriptor when de
Same weakness: CWE-369
-
CVE-2026-93589
ImageMagick before 7.1.2-31 Division by Zero in FLIF encoder -
CVE-2026-92881
vgmstream AWB parser awb.c init_vgmstream_awb_memory divide -
CVE-2026-91955
FreeRDP before 3.31.0 Denial of Service via Desktop Dimensio -
CVE-2026-15417
CP210x Denial of Service -
CVE-2026-6244
division by zero in libpcap before 1.10.7
V. Comments for CVE-2026-10679
No comments yet